Forward pfsenselogs to graylog

I don't know a lot about asterisk but I've some experience with graylog. I'd recommend starting with one of their downloadable virtual machines (thought they now have nice packages for redhat/centos/debian/ubuntu.

This is very much a simplification but there are basically 2 types of input for graylog; GELF, and syslog. GELF (Graylog Extended Logging Format) is a rich and customisable way of getting log events into graylog. Syslog is the logging capability that pretty much everything has. I found this for asterisk:

https://wiki.asterisk.org/wiki/display/AST/Logging+Configuration

So what I would do is:

1. get the graylog vm up and running in a test network switch on a syslog input, get familiar with the interface, searching, streams and dashboards (the nginx content pack is fantastic for this). Sending test messages with the logger command is helpful.

2. Get asterisk pointed to your graylog syslog server, you should now see the syslog events in graylog.

At this point you will have all the awesome that centralised logging provides, you now a rapid way to view events in your system when there is trouble without having to scrape logs of a half a dozen systems.

I think SNMP might be a complementary thing here rather than something you would use directly with logs, if the asterisk system raised and SNMP trap you might also expect to see the event logged in it's syslog depending on configuration etc. Graylog has extractors which will let you parse the asterisk messages.

I traced this back to the elasticsearch_discovery_zen_ping_unicast_hosts value in /etc/graylog/server/server.conf. This is a Java property file so values need to be formatted as such:

elasticsearch_discovery_zen_ping_unicast_hosts = 10.1.10.134:9300
elasticsearch_discovery_zen_ping_unicast_hosts = 10.1.10.134:9300,10.1.10.133:9300

Avoid YAML formats like this. The Graylog code, as in 1.1.6, does not flag improperly formatted values.

elasticsearch_discovery_zen_ping_unicast_hosts = "10.1.10.134:9300"
elasticsearch_discovery_zen_ping_unicast_hosts = [ "10.1.10.134:9300" ]